Electronic Identification (Correspondence, 02/15/94, GAO/AIMD-94-69R).

GAO responded to a request from the Bureau of the Census about whether
Census's travel order system, which uses electronic techniques to
identify the individuals processing a travel order, is required to meet
GAO requirements for electronic signatures. GAO noted that its criteria
for electronic signatures do not apply to the Census travel order
system, since: (1) Census still requires a handwritten signature on
travel orders; and (2) the system uses user identification codes which
are not an acceptable electronic signature technique.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  AIMD-94-69R
     TITLE:  Electronic Identification
      DATE:  02/15/94
   SUBJECT:  Internal controls
             Electronic equipment
             Computerized information systems
             Systems design
             Systems evaluation
             Requirements definition
             Financial management systems
             Electronic forms
             Records management
             Identification codes

             
******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                    <info@www.gao.gov>                        **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************


Cover
================================================================ COVER



February 1994


GAO/AIMD-94-69R

Electronic Identification

(511470)


Abbreviations
=============================================================== ABBREV


Letter
=============================================================== LETTER


B-256311

February 15, 1994

Mr.  Michael S.  McKay
Chief, Management and Security
 Systems Division
Bureau of the Census
Department of Commerce

Dear Mr.  McKay: 

This letter responds to your August 11, 1993, request in which you
asked whether Census's travel order system, which uses electronic
techniques to identify the individuals processing a travel order
(Commerce Form 29), is required to meet GAO's requirements for
electronic signatures.  Based on the material provided with your
letter and conversations with your staff, we do not believe that the
criteria contained in 71 Comp.  Gen.  109 (1991) for electronic
signatures that create obligations binding on the federal government
apply to your system because Census still requires a handwritten
signature on the travel order. 

As noted in your letter and conversations with your staff, your
travel order system uses user identification codes.  We generally do
not consider user identification codes as an acceptable electronic
signature technique.  However, we note that in this case they are not
used as signatures but instead to identify the individuals who
processed the travel order.  The travel order system uses these
identification codes to determine, among other things, when the order
should be submitted to the proper office for signature.  Once the
system has decided that the order is ready for signature, the order
is routed electronically to a special printer.  Then, an authorized
individual takes the printed travel order, reviews it, and denotes
approval by signing the paper copy.  Once the travel order is signed
by an authorized individual, it becomes a binding obligation of the
federal government.  Further, we note that any actions resulting in
an expenditure of funds also require a handwritten signature.  For
example, your procedures require the traveler to sign for any travel
advance received. 

Although the criteria for electronic signatures do not appear to
apply to your travel order system, Census is required by 31 USC
3512(c)(1) to establish and maintain a system of adequate internal
controls to safeguard government resources.  Appendix II in GAO's
Title 2,\1 also directs agencies to have in place an effective system
to monitor the implementation of its internal control structure to
ensure that it is adequate.  This includes a requirement that
agencies test their controls in sufficient scope, depth, and
frequency to provide reasonable assurance that key processing
procedures are working and reliable.  Since the official signing the
travel order appears to place significant reliance on the automated
system to ensure that the data presented is reliable, we believe that
you should periodically test this system to ensure that it provides
the authorizing official reasonable assurance that its controls are
functioning as designed. 

This letter provides our views on whether your travel order system is
required to meet our criteria for electronic signatures and does not
express an opinion on the adequacy of your system.  Accordingly, it
does not constitute GAO approval of your financial management system,
as defined by 31 U.S.C.  3512(f)(2). 


--------------------
\1 "Accounting," GAO's Policy and Procedures Manual for Guidance to
Federal Agencies. 


---------------------------------------------------------- Letter :0.1

We recognize the challenges that your agency faces in automating its
administrative systems and appreciate the opportunity to comment on
your travel order system.  We hope that our comments will assist your
efforts.  Should you have any questions, please contact Chris Martin,
Assistant Director, at (202) 512-9481. 

Sincerely yours,

Dr.  Rona B.  Stillman
Chief Scientist
 for Computers and Communications

*** End of document. ***